From 5ab49ddaa444f4e7bae1700542393e033ddbf9f0 Mon Sep 17 00:00:00 2001
From: Wael Nasreddine <wael.nasreddine@gmail.com>
Date: Sat, 17 Jan 2026 00:36:01 -0800
Subject: [PATCH] nixos/ncps: Add a new option for --cache-lock-backend

---
 nixos/modules/services/networking/ncps.nix | 20 ++++++++++++++++++++
 nixos/tests/ncps-ha.nix                    |  2 ++
 2 files changed, 22 insertions(+)

diff --git a/nixos/modules/services/networking/ncps.nix b/nixos/modules/services/networking/ncps.nix
index 45733a964170..16737d63626d 100644
--- a/nixos/modules/services/networking/ncps.nix
+++ b/nixos/modules/services/networking/ncps.nix
@@ -51,6 +51,7 @@ let
   serveFlags = lib.concatStringsSep " " (
     [
       "--cache-hostname='${cfg.cache.hostName}'"
+      "--cache-lock-backend='${cfg.cache.lock.backend}'"
       "--cache-temp-path='${cfg.cache.tempPath}'"
       "--server-addr='${cfg.server.addr}'"
     ]
@@ -232,6 +233,17 @@ in
           };
         };
 
+        lock.backend = lib.mkOption {
+          type = lib.types.enum [
+            "local"
+            "redis"
+          ];
+          default = "local";
+          description = ''
+            Lock backend to use: 'local' (single instance), 'redis' (distributed).
+          '';
+        };
+
         maxSize = lib.mkOption {
           type = lib.types.nullOr lib.types.str;
           default = null;
@@ -487,6 +499,14 @@ in
           cfg.cache.redis == null || cfg.cache.redis.password == null || cfg.cache.redis.passwordFile == null;
         message = "You cannot specify both config.ncps.cache.redis.password and config.ncps.cache.redis.passwordFile";
       }
+      {
+        assertion = cfg.cache.lock.backend == "redis" -> cfg.cache.redis != null;
+        message = "You must specify config.ncps.cache.redis when config.ncps.cache.lock.backend is set to 'redis'";
+      }
+      {
+        assertion = cfg.cache.redis != null -> cfg.cache.lock.backend == "redis";
+        message = "You must set config.ncps.cache.lock.backend to 'redis' when config.ncps.cache.redis is set";
+      }
     ];
 
     users.users.ncps = {
diff --git a/nixos/tests/ncps-ha.nix b/nixos/tests/ncps-ha.nix
index e4e8759b9f7c..4bf5c6832ab8 100644
--- a/nixos/tests/ncps-ha.nix
+++ b/nixos/tests/ncps-ha.nix
@@ -35,6 +35,8 @@ let
 
         databaseURL = "postgres://ncps:${lib.escapeURL postgresPassword}@postgres:5432/ncps?sslmode=disable";
 
+        lock.backend = "redis";
+
         secretKeyPath = builtins.toString (
           pkgs.writeText "ncps-cache-key" "ncps:dcrGsrku0KvltFhrR5lVIMqyloAdo0y8vYZOeIFUSLJS2IToL7dPHSSCk/fi+PJf8EorpBn8PU7MNhfvZoI8mA=="
         );